Authorization terminology is a mess: Let's fix it

https://xkcd.com/927

Nice work and all regardless

turns out naming is important

I love how the OIDC standard is littered with “authentication identity token code id cookie identifier” and many subtle variations of homonyms in slightly different combinations and orders.

I’m sure someone thought it all made perfect sense.

Probably someone who never confuses “empathy” and “sympathy” while also carefully distinguishing between “should” and “ought”.

Unclosable cookie banner. Top notch website engineering.

> can this subject perform this action on this object?

IMHO, the most elegant method to answer this question is capability based access control. If the subject can utter the action, then it can perform it. And then delegation is the transfer of nouns and verbs to perform the utterances.

excellent article, very thorough and nuanced explanation.

Nice!

I'd like to fix the prior abstract. Auth and auth upsets me greatly cos we have:

Authentication & Authorization

and we call both/either auth. Hence please help me make this a thing:

AuthENTIcation & AuthORIzation : ENTI & ORI

ENTI- can you enter, ORI (or ORIZ) what can you do?